feat: add pnpm as package manager

[serendipty01]

Context & Requests for Reviewers

fixes #337

Why pnpm over npm?

Disk space efficiency — pnpm uses a content-addressable store where all package files are saved in a single location and hard-linked into each project's node_modules. If you have 100 projects using a dependency, npm stores 100 copies on disk; pnpm stores one. When a new version changes only one file out of 100, only that single file is added to the store rather than cloning the entire package. Docs

Faster installations — pnpm performs installation in three concurrent stages — dependency resolution, directory structure calculation, and linking — where packages are resolved, fetched, and hard-linked as soon as possible, rather than npm's sequential resolve-then-fetch-then-write approach. Docs

Strict, correct node_modules — npm maintains a flattened dependency tree, which means source code can accidentally access packages that aren't declared in package.json. pnpm uses symlinks so only direct dependencies are visible at the top level, helping avoid bugs caused by relying on undeclared transitive dependencies. Docs

No phantom dependencies — pnpm does not allow installation of packages without saving them to package.json, so projects won't accumulate extraneous packages over time.

Note

For Coop, jest-snapshot and @types/express-serve-static-core are added.

Supply chain security — pnpm v10+ ships with several built-in protections that npm lacks:

• Blocked postinstall scripts by default — pnpm v10 disables automatic execution of postinstall scripts in dependencies, and lets you explicitly allowlist only trusted packages via allowBuilds.
• Minimum release age — pnpm v11 defaults minimumReleaseAge to 1440 minutes (1 day), meaning newly published packages won't be resolved until they are at least a day old, giving the community time to detect compromised versions.
• Exotic subdep blocking — you can prevent transitive dependencies from pulling from git repos or direct tarball URLs, ensuring all transitive dependencies are resolved from trusted sources.
• Trust policy — the trustPolicy setting can prevent installation of a package if its trust level has decreased compared to previous releases (e.g., a package that was previously published by a trusted publisher but now lacks provenance).

Note

This is not present in PR as builds are breaking due to many outdated dependencies.

Adopted by major open-source projects — pnpm's workspace feature is already used by some of the most prominent projects in the ecosystem like Next.js, Vue, Vite, Nuxt, Astro, SvelteKit, n8n etc.

Reference:
https://pnpm.io/pnpm-vs-npm

Tests

(Optional) Rollout Plan